mass.report
Scan Intelligence Report0/100
high Risk
www-airwalllex.cursoinvista.com.br
https://www-airwalllex.cursoinvista.com.br/?gad_source=1&gad_campaignid=24002463514&gbraid=0AAAABBtuvx4eelp1RxEXVj38cyKRzRDKW&gclid=EAIaIQobChMI-Y-d2MW2lQMVyFBBAh3vcDdjEAAYASAAEgJvOfD_BwE
IP
104.21.27.170 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
5329 days
HTTP
200 · 56.6s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Visual Evidence
Zoom
Title: "Airwallex: Open a Business Account In Minutes for Global Businesses"
Registered-domain escalation
Submit cursoinvista.com.br as the primary IOC, enriched with evidence from hostile subdomains like www-airwalllex.cursoinvista.com.br.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Airwallex
Credential PhishingFinance & Banking · 7/19/2026
Summary
The page presents Airwallex branding and UI, but the domain is a suspicious subdomain (www-airwalllex.cursoinvista.com.br) not owned by Airwallex. Visuals and page title imitate Airwallex’s landing page, and the HTML loads multiple external scripts and an iframe from a different domain, indicating potential credential collection on a spoofed page. The presence of an iframe and dynamic content suggests possible credential capture despite no static login form detectable in the initial HTML; in SPA contexts credentials may be rendered by scripts. Overall, indicators support impersonation/phishing risk rather than legitimate first-party content on Airwallex domain.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www-airwalllex.cursoinvista.com.br/cdn-cgi/rum?.
▸Distinctive asset clues: v4513226cdae34746b4dedf0b4dfa099e1781791509496, v37Dosp373x-store.js, entry.BnO0UWo9.css, BayduuLandingPage.DXcg51jw.css.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 206
Hosts: 4
Domains: 4
Attack Techniques (4)
Brand impersonation via visual cloning (Airwallex branding on a non-official domain)SPA-style credential capture risk (dynamic forms rendered by JavaScript)Iframe-based content loading from third-party domain (iframe to web.sakshiinfoway.com/airwallex)External script loading from third-party domains (cdn.searchad.com.br, cloudflare beacon)
Indicators of Compromise (9)
▸Page title matches Airwallex branding
▸Hostname does not match official Airwallex domain (Airwallex branding shown on www-airwalllex.cursoinvista.com.br vs official airwallex domains)
▸Iframe pointing to a different domain (https://web.sakshiinfoway.com/airwallex)
▸External script sources not owned by Airwallex (cdn.searchad.com.br, static.cloudflareinsights.com)
▸POST to /cdn-cgi/rum which resembles Cloudflare-related activity but on a suspicious host
▸SSL cert issued for cursoinvista.com.br, not for Airwallex official cert; domain age long but the host is a third-party subdomain
▸Suspicious domain: cursoinvista.com.br hosting a subdomain that displays Airwallex branding
▸No static HTML login form, but SPA pattern suggests forms may be rendered via JavaScript
▸UI clone including Airwallex imagery and layout in a non-official domain
Risk AssessmentUsed in abuse reports
The scan shows strong indicators of brand impersonation: the page uses Airwallex branding and a page title that matches Airwallex, yet the hostname is a third-party domain (www-airwalllex.cursoinvista.com.br). An iframe loads content from web.sakshiinfoway.com, and multiple third-party scripts are loaded. The static HTML contains no login form, but SPA behavior is possible, meaning credentials could be captured via dynamically injected forms. The combination of impersonation signals, off-brand hosting, and cross-domain iframe usage constitutes a high-risk phishing setup. Recommend action and monitoring accordingly.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API